CVE-2021-43979

MEDIUM
Published Nov 17, 20214y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Nov 17, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-670

Affected Products 1

VendorProductVersionRange
openpolicyagentgatekeeper* ≤3.7.0

References 2

  • github.com https://github.com/hkerma/opa-gatekeeper-concurrency-issue
    Third Party Advisory
  • github.com https://github.com/open-policy-agent/gatekeeper/releases
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/open-policy-agent/gatekeeper/releases
    PatchThird Party Advisory